Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
289 detections
Filters
Last updated
All Time
Detection languages
109
73
41
24
20
Contributors
58
47
46
33
19
Categories
68
66
59
48
40
Platforms
224
51
50
23
10
Products / Services
10,665
9,773
6,704
4,421
3,749
289
MITRE Techniques
69
68
65
54
43
CVEs
12
6
6
6
5
IDS Classtypes
18
3
2
2
1
IDS Protocols
21
2
1
This rule detects potential exploitation attempts targeting vulnerabilities in FortiClient EMS. It specifically looks for indicators such as requests lacking proper certificate headers or suspicious requests to 'service/save.php' on the FortiClient EMS server, which are commonly associated with CVE-2026-35616.
Detects instances where FortiClient EMS (versions 7.4.5 or 7.4.6) logs a 'Certificate not found in request header' error. This indicates that a client attempt to communicate with the EMS server failed due to missing certificate-based authentication, which could suggest misconfiguration, network issues, or potentially an unauthorized attempt to access the management interface.
Detects potential exploitation attempts against FortiClient EMS versions 7.4.5-7.4.6, specifically targeting the administration API on port 8013. The detection identifies unauthorized access attempts indicated by the log entry 'Certificate not found in request header', which correlates with exploit behavior for CVE-2026-35616.
Detects the creation of an administrative account named 'adminin' on FortiGate devices. This specific account name has been linked to the 'FortiBleed' credential theft campaign, which often serves as a precursor to ransomware deployment by threat actors like the INC Ransom group.
Detects the execution of 'FortiGateSniffer', a tool identified as Golang-based, used to perform passive network packet capture on compromised FortiGate devices. The rule also analyzes captured traffic for sensitive authentication protocols including RADIUS, Kerberos, and NTLM.
Detects the execution of the FortigateSniffer binary or the use of the 'diagnose sniffer packet' command on FortiGate devices, which are used to passively intercept network traffic including authentication protocols like RADIUS, NTLM, and Kerberos.
Detects execution of PowerShell with encoded commands ('-enc') and window style hidden ('-w 1') initiated by processes associated with Fortinet FortiClient (e.g., scheduler.exe, fortitray.exe), or matching known encoded command patterns. This often indicates the use of legitimate management processes to execute obfuscated malicious scripts.
Detects the use of the 'diagnose sniffer packet' command on a FortiGate network device, which is indicative of an administrator or attacker performing network traffic capture and analysis directly from the device's management interface.
Detects potential exploitation attempts of CVE-2026-35616 targeting Fortinet FortiClient EMS versions 7.4.5 and 7.4.6. The rule identifies suspicious indicators such as API authentication bypass attempts marked by missing certificate headers, unauthorized modifications to remote access VPN profiles, and unauthenticated administrative API access on port 8013.
Detects the use of the 'diagnose sniffer packet' command on FortiOS, or evidence of the FortigateSniffer tool (associated with past FortiGate vulnerabilities). This behavior is indicative of unauthorized packet capture and potential credential sniffing on network infrastructure devices.
Detects the addition of firewall address objects on a Fortinet FortiGate Firewall.
This rule computes a composite risk score for user authentication events across multiple identity and network providers (Okta, Azure AD, VPNs, etc.). It flags suspicious patterns including impossible travel, credential stuffing indicators (multiple failures followed by success), new or unknown devices, and lateral movement attempts (concurrent access to both VPN and SSO services). Only users meeting a risk score threshold of 40 or higher with at least one successful authentication are reported.
Detects the creation of an administrator account on a Fortinet FortiGate Firewall.
Detects the addition of a new firewall policy on a Fortinet FortiGate Firewall.
Detects the modification of a user group on a Fortinet FortiGate Firewall.
The group could be used to grant VPN access to a network.
The group could be used to grant VPN access to a network.
Detects the modification of VPN SSL Settings (for example, the modification of authentication rules).
This behavior was observed in pair with the addition of a VPN SSL Web Portal.
This behavior was observed in pair with the addition of a VPN SSL Web Portal.
Campaign converting compromised FortiGate firewalls into credential stealers
Detects potential exploitation attempts against management interfaces of SOHO network devices (Cisco, Ubiquiti, Draytek) by monitoring for suspicious web request activity, specifically targeting paths like /admin, /cgi-bin, or /setup.cgi. The rule identifies high-volume or systematic scan patterns from external sources, which may indicate automated exploitation attempts (e.g., related to CVE-2026-35616).
This rule monitors network logs (from proxies and firewalls) for web traffic (HTTP GET requests) containing suspicious JavaScript code injection patterns in the request context or message fields. It specifically looks for common XSS indicators such as <script tags, eval(), document.write(), fromCharCode(), and atob().
Detects the creation of a new local user on a Fortinet FortiGate Firewall.
The new local user could be used for VPN connections.
The new local user could be used for VPN connections.
Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall.
This behavior was observed in pair with modification of VPN SSL settings.
This behavior was observed in pair with modification of VPN SSL settings.
Page 6 of 14